Revolut hackers demand $3M in Monero ransom and threaten to sell customer data after targeting accounts via blockchain analysis.
Regulation & Gov ·
A criminal group calling itself iamnotavillain has demanded 6,000 XMR (approximately $3 million) from Revolut within 24 hours, threatening to sell hundreds of customers' identity documents and transaction records if the demand is not met. The group posted the demand on a dedicated website and specified that failure to comply would result in data being sold to other criminals. Revolut stated it has received no direct contact or demand.
The breach itself resulted from a sophisticated impersonation campaign exploiting a compromised Italian government email system. The attackers posed as a government agency, sending information requests to Revolut over several months that the company initially mistook as legitimate, affecting at least 680 accounts. The stolen data included names, dates of birth, addresses, passport or driving licence copies, selfies submitted for identity verification, account statements with banking and wallet references, and full transaction histories. What distinguishes this incident is the targeting methodology: the group used blockchain analysis to identify Revolut customers with substantial cryptocurrency holdings before pursuing their accounts.
Monero's privacy features—which obscure sender, recipient, and transaction amounts through ring signatures and stealth addresses—made it the demanded payment method, though the group did not indicate whether it would accept other cryptocurrencies. The use of verified identity documents combined with proven on-chain holdings and home addresses creates a profile that has coincided with rising physical attacks on known cryptocurrency owners. Revolut has characterized the number of affected customers as limited and stated that funds and systems remained untouched.